Chapter 49 — Engineering thesis | Engineering Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 49 — Engineering thesis

Lesson map

Lesson 49 published. Map, example, EX145.

flowchart TD
  N0["Learning outcomes"]
  N1["49.1 The claim"]
  N2["49.2 Evidence chapters"]
  N3["49.4 Generalisation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX145"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["49.1 The claim"]
  N2["49.2 Evidence chapters"]
  N3["49.4 Generalisation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX145"]

[Learning outcomes]
    |
    v
[49.1 The claim]
    |
    v
[49.2 Evidence chapters]
    |
    v
[49.4 Generalisation]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX145]

Learning outcomes

You will (1) write an engineering thesis around a design claim; (2) present evidence and limits; (3) generalise lessons carefully.

49.1 The claim

Zara's thesis claims that a privacy-preserving research data service, built from templates, output checks and differential privacy budgets, can support useful outcome analysis for a telemedicine provider without record-level access, with verified protection against the reconstruction attacks tested. The claim is bounded: one organisation, one analysis type, synthetic verification data and a small researcher evaluation. She states the bounds in the abstract and the introduction so that no reader mistakes the claim for a general solution. Bounded claims are easier to defend under examination.

49.2 Evidence chapters

The thesis presents requirements traced to law, the design and its review, the implementation, verification results including failures and fixes, the reconstruction attack, the researcher evaluation and the evidence dossier. Each chapter answers part of the claim. Zara includes the expiry bug and the failing erasure store from the dossier, explaining how each was found and fixed. Examiners, she argues, should see that the verification process works because it found real problems, not because everything passed the first time. Each failure cites its fix and retest.

49.3 Limits

Zara writes limits clearly. Template systems restrict exploratory research. National aggregation reduces timeliness for rare conditions. Differential privacy budgets require careful management and expert implementation. Legal analysis relies on GDPR and LGPD texts and EDPB guidance, not case law. The service depends on the consent service and privacy platform, which must remain reliable. She also notes that real patient data might behave differently from synthetic test data, and that a real deployment would need its own DPIA. She also lists untested threats openly.

49.4 Generalisation

Zara discusses what other organisations could learn. The pattern of approved templates, output checks and per-study budgets could transfer to other health providers, but the parameters depend on population size, query types and risk appetite. She cites NIST SP 800-188 and Dwork and Roth (2014) for the general methods and Pellmore's results for one configuration. She avoids recommending specific epsilon values for others. Prof. Holm praises the restraint, noting that over-generalisation is a common weakness in engineering theses. She describes a method for choosing epsilon instead of recommending values.

Worked example

Zara writes a bounded thesis claim, presents evidence including failures, lists limits from template restrictiveness to synthetic data and generalises the pattern without prescribing parameters.

Synthetic case. The thesis is synthetic; NIST SP 800-188 and Dwork and Roth (2014) are real.

Errors and limits

A bounded claim can still be misquoted; repeat the bounds in summaries.

Exercises

EX145 — Thesis bounds. List the bounds of Zara's claim. Rubric: 3 = one organisation, one analysis type, synthetic verification, small evaluation;; 2 = three;; 1 = one;; 0 = none.
EX146 — Failures in thesis. Why include the expiry bug and failing store? Rubric: 3 = they show verification found and fixed real problems;; 2 = mentions honesty;; 1 = hide them;; 0 = none.
EX147 — No epsilon advice. Why does Zara avoid recommending epsilon values for others? Rubric: 3 = parameters depend on each organisation's population, queries and risk appetite;; 2 = mentions context;; 1 = gives values;; 0 = none.

Synthesis

Chapter 49 writes the thesis. Chapter 50 is the final defense.

Continue studying — chapter 49 of 50

← Chapter 48 (draft) · Course chapter index · Chapter 50 (draft) →